snoop Command and IPsec

The snoop command can parse AH and ESP headers. Because ESP encrypts its
data, the snoop command cannot see encrypted headers that
are protected by ESP. AH does not encrypt data. Therefore, traffic that is
protected by AH can be inspected with the snoop command.
The -V option to the command shows when AH is in use on a
packet. For more details, see the snoop(1M) man page.